Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects the use of PowerShell to archive files (using Compress-Archive) followed by an HTTP network connection to a suspicious external IP address (91.196.32.232) within a short time window. This sequence is often indicative of data staging followed by exfiltration.
Detects evidence of Argamal RAT activity involving screenshot capture using .NET Graphics.CopyFromScreen methods written to a specific temporary file (~wra1269.tmp). The rule monitors both PowerShell execution patterns and file creation events associated with this specific artifact.
Detects the creation of image files (JPEG, BMP, PNG) in temporary system directories by processes not associated with standard UI, browser, or imaging applications. This behavior is indicative of infostealer malware, such as StealC or Amadey, using GDI APIs like BitBlt or CreateCompatibleDC to capture desktop screenshots.
Detects evidence of potential data exfiltration activities including the execution of known exfiltration scripts, the use of netcat for unauthorized data transfer to a specific C2 IP, and the presence or access of BloodHound dump files. The rule also monitors for network communication with a known command and control IP address.
Detects unauthorized access to browser-based credential stores (such as Cookies and Login Data for Chrome, Edge, and Firefox) by non-browser processes. This behavior is a common indicator of credential harvesting by infostealer malware, such as Vidar, attempting to exfiltrate session cookies and stored credentials.
Detects unauthorized processes accessing browser credential databases (e.g., Login Data, Cookies, Web Data) associated with Chromium-based browsers on macOS. This behavior is indicative of credential harvesting often performed by infostealers like AMOS (Atomic macOS Stealer).
Detects suspicious processes (e.g., node.exe, chost.exe, python) accessing sensitive credential files and subsequently exfiltrating data to the Telegram Bot API via HTTPS POST requests within a 10-minute window. This behavior is indicative of infostealer malware, such as those observed in the Friday Harvest campaign, harvesting and exfiltrating system data.
Detects rapid enumeration of SharePoint sites, drives, lists, and document libraries from one account, which can precede targeted data collection. This rule identifies a high volume of GET requests to SharePoint-related URIs within a short timeframe, indicating potential reconnaissance or data exfiltration attempts.
Detects process command lines containing references to sensitive Unix system files (/etc/passwd or /etc/shadow) specifically when accessed within or in association with a /troot/ directory path. This pattern is often indicative of an adversary performing reconnaissance or credential dumping.
Detects session hijacking consistent with Browser-in-the-Middle (BitM) attacks like Bluekit PhaaS, where an attacker captures an authenticated session token. The rule identifies instances where a successful MFA-protected login event is immediately followed by a session reuse event from a different IP address or network location, which is indicative of the attacker utilizing the intercepted session.
Detects Python scripts or processes accessing common browser credential and cookie storage files (such as Login Data, key4.db, or cookies.sqlite) and subsequently making outbound network connections, indicating potential theft and exfiltration of browser data.
Detects network activity associated with Bluekit phishing infrastructure, which utilizes WebSocket connections for real-time browser session exfiltration. The rule monitors for characteristic HTTP upgrade requests to WebSockets containing 'rrweb' or 'session' query parameters, or connections to known Bluekit phishing domains, which allow attackers to stream DOM, keystrokes, and mouse movements from a victim's browser to an attacker-controlled dashboard.
Detects macOS.Gaslight malware activity through two branches: direct hash matches of known binaries and the spawning of Python subprocesses with specific command-line arguments indicative of data collection or archiving. The Python subprocess detection looks for Python scripts being executed from '/tmp/' or '/Library/' directories with arguments related to browser data collection, keychain access, or archiving operations.
This rule detects successful network logons (LogonType 3) using NTLM (NTLMv1 or NTLMv2) where the authentication results in an elevated token and the logon originates from a different workstation than the target computer. This combination of factors can indicate lateral movement attempts, especially when an adversary has obtained NTLM hashes (e.g., via Pass-the-Hash or NTLM relay attacks) and is attempting to authenticate to other systems on the network. The rule excludes machine accounts and anonymous logons, as well as loopback authentications, to reduce noise.
Detects when 'explorer.exe' performs clipboard access actions such as opening, getting data from, or setting a clipboard viewer. While 'explorer.exe' is a legitimate Windows process, unusual or excessive clipboard activity from it could indicate suspicious behavior, potentially related to data collection or manipulation.
Detects attempts to upload files to the SharePoint master page gallery using a POST request. This activity can be indicative of an attacker attempting to establish persistence or deface the SharePoint site by modifying its core components. The rule specifically looks for requests to '_layouts/15/Upload.aspx' or '_layouts/Upload.aspx' with 'RootFolder' and 'List' parameters containing '_catalogs/masterpage' or directory traversal sequences ('../').
This rule detects attempts to install a keyboard hook (WH_KEYBOARD_LL) using the SetWindowsHookEx API, specifically when the initiating process is 'explorer.exe'. This behavior can be indicative of keylogging activity, where an attacker attempts to capture keystrokes.
Detects a potential logging sink hijack in Google Cloud Platform (GCP) by identifying the deletion of a logging sink's destination bucket followed by the creation of a new bucket with the same name in a different project. This technique could allow an attacker to redirect logs to an attacker-controlled bucket, impairing defenses and potentially exfiltrating sensitive log data.
Detects a web session that proxies an enterprise authorisation endpoint while also handling session-cookie names associated with authenticated access. This rule identifies suspicious activity indicative of an Adversary-in-the-Middle (AiTM) attack where an attacker proxies authentication requests and steals session cookies.
This rule detects potential credential capture by monitoring for unauthorized usage of Windows API functions associated with keyboard hooking, such as SetWindowsHookEx and GetAsyncKeyState. It specifically flags suspicious process activity, such as the execution of the 'Pillager' tool or processes interacting with specific suspicious file paths, while excluding common legitimate processes that routinely perform keyboard hooking.
Detects enumeration of hardware asset inventories via web or network
Page 99 of 173